zsh/zdharma-continuum.zinit
1
0
Fork 0
mirror of https://github.com/zdharma-continuum/zinit.git synced 2026-09-10 07:36:38 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(install): retry and auth github api downloads

Browse source 
.zinit-download-file-stdout made every request anonymously and gave
up on the first transient error. The gh-r test suite alone exceeds
GitHub's anonymous API limit of 60 requests/hour/IP, and racing CI
runs trip per-IP abuse throttling, failing whole zunit slices (run
33138613456: 28 failures, all rate-limited downloads).

Send Authorization from GITHUB_TOKEN/GH_TOKEN, strictly limited to
api.github.com so tokens never reach asset CDNs, mirrors, or snippet
hosts, and retry transient HTTP errors in curl and wget.

Signed-off-by: Vladislav Doster <mvdoster@gmail.com>
This commit is contained in:
Vladislav Doster 2026-08-28 01:47:30 -05:00 committed by vladislav doster
parent 63e5e9fac8
commit eaa1056699
1 changed files with 16 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
zinit-install.zsh
View file

@ -666,6 +666,16 @@ builtin source "${ZINIT[BIN_DIR]}/zinit-side.zsh" || {
builtin emulate -LR zsh ${=${options[xtrace]:#off}:+-o xtrace} builtin emulate -LR zsh ${=${options[xtrace]:#off}:+-o xtrace}
setopt localtraps extendedglob setopt localtraps extendedglob
# Authenticate GitHub API requests when a token is available — the anonymous
# limit of 60 requests/hour/IP is too low for e.g. CI runners. Restricted to
# api.github.com so the token is never sent to any other host.
local -a curl_auth wget_auth
local gh_token=${GITHUB_TOKEN:-$GH_TOKEN}
if [[ $url == https://api.github.com/* && -n $gh_token ]] {
curl_auth=( -H "Authorization: Bearer $gh_token" )
wget_auth=( --header="Authorization: Bearer $gh_token" )
}
# Return file directly for file:// urls, wget doesn't support this schema # Return file directly for file:// urls, wget doesn't support this schema
if [[ "$url" =~ ^file:// ]] { if [[ "$url" =~ ^file:// ]] {
local filepath=${url##file://} local filepath=${url##file://}
@ -682,12 +692,12 @@ builtin source "${ZINIT[BIN_DIR]}/zinit-side.zsh" || {
if (( ${+commands[curl]} )); then if (( ${+commands[curl]} )); then
if [[ -n $progress ]]; then if [[ -n $progress ]]; then
command curl --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1 command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1
else else
command curl -fsSL "$url" || return 1 command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" -fsSL "$url" || return 1
fi fi
elif (( ${+commands[wget]} )); then elif (( ${+commands[wget]} )); then
command wget ${${progress:--q}:#1} "$url" -O - || return 1 command wget --tries=3 "${wget_auth[@]}" ${${progress:--q}:#1} "$url" -O - || return 1
elif (( ${+commands[lftp]} )); then elif (( ${+commands[lftp]} )); then
command lftp -c "cat $url" || return 1 command lftp -c "cat $url" || return 1
elif (( ${+commands[lynx]} )); then elif (( ${+commands[lynx]} )); then
@ -701,12 +711,12 @@ builtin source "${ZINIT[BIN_DIR]}/zinit-side.zsh" || {
} else { } else {
if type curl 2>/dev/null 1>&2; then if type curl 2>/dev/null 1>&2; then
if [[ -n $progress ]]; then if [[ -n $progress ]]; then
command curl --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1 command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1
else else
command curl -fsSL "$url" || return 1 command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" -fsSL "$url" || return 1
fi fi
elif type wget 2>/dev/null 1>&2; then elif type wget 2>/dev/null 1>&2; then
command wget ${${progress:--q}:#1} "$url" -O - || return 1 command wget --tries=3 "${wget_auth[@]}" ${${progress:--q}:#1} "$url" -O - || return 1
elif type lftp 2>/dev/null 1>&2; then elif type lftp 2>/dev/null 1>&2; then
command lftp -c "cat $url" || return 1 command lftp -c "cat $url" || return 1
else else